About Earnie
What is Earnie?
Earnie is an agent-native control plane for software governance. It detects the open source, AI models, cryptography and security vulnerabilities in your codebase, applies your policies wherever code is written, and keeps a defensible record of every decision.
Who makes Earnie?
Earnie is built by the team behind SCANOSS, who have spent years building a knowledge base of open source code and the technology that matches code against it. Meet the team.
Is Earnie open source?
No. Earnie is a commercial product.
What Earnie detects
What does Earnie detect?
Four things: open source, AI models, cryptography and known security vulnerabilities. One policy covers all four.
Which languages and ecosystems are covered?
Earnie matches code by its content, not by package name, so coverage comes from the knowledge base behind it: 100 billion files from 107 sources, including GitHub, npm, Maven Central, PyPI, Go, NuGet, Debian, Fedora, Anaconda, SourceForge and Stack Overflow. See the full breakdown by source in the Product page.
Can Earnie find open source that was copied in without a package manager?
Yes. Earnie identifies open source down to snippet level, so it finds code that was copied, vendored, modified or generated by AI, even when there is no manifest to read.
How does Earnie detect AI models? Is it guessing?
No. Earnie fingerprints the model files in your code and compares them against the AI Model Dataset, a new proprietary dataset of known models. A match is made on the files themselves, not guessed from names or metadata.
How does Earnie help with post-quantum cryptography?
Earnie finds the cryptographic algorithms and libraries in your code and shows what needs to change for post-quantum migration.
Does Earnie find security vulnerabilities?
Yes. Earnie maps known vulnerabilities, drawn from NVD CVEs and GitHub Security Advisories, to the code where they live, down to the file and version.
How Earnie works
Where does Earnie run?
In four places: inside AI coding assistants through MCP, in the terminal through the CLI, in your CI/CD pipelines, and in a web UI. The same policy blocks the same issue in all four.
Can Earnie block a dependency before an agent adds it?
Yes. Through MCP, Earnie checks a dependency against your policy before the agent adds it. When something breaks the policy, Earnie catches it and suggests the fix, and your agent applies it.
Can Earnie enforce our policies?
Yes. Set a policy once and Earnie applies it across every project and every surface.
Can I check a finding myself?
Yes. Every finding opens into a side-by-side view of your code against the source it matched, so you can verify it instead of taking our word for it.
Your code and your data
Does my code leave my environment?
No. Earnie runs on your own server and reads your code there. On SaaS, only fingerprints, one-way hashes of your code, go to the knowledge base we host. On-prem, nothing leaves your network.
Can Earnie run on our own infrastructure?
It always does. Earnie runs on your own server in both models. On SaaS, it matches fingerprints against the knowledge base we host. On-prem, the knowledge base runs on your server too, including in air-gapped environments. Every customer gets their own instance.
Can we choose where our SaaS instance is hosted?
Yes. Earnie runs on your own server, wherever you put it, and you choose the region of the knowledge base we host for you.
Can I sign up online?
No. Every customer starts with a proof of concept on their own code, and our team helps you set up Earnie on your server along the way. Request a demo.
Already a SCANOSS customer?
I'm already a SCANOSS customer. Do I have to migrate?
No. Everything you have keeps running: your API keys, CLI tooling and CI/CD integrations. When you choose to move onto Earnie, your configuration comes with you.
Will my price change?
No. Your existing datasets keep their current price. The Earnie surfaces are not an extra line item.
Will support change?
No. Same support team, same SLA.
Regulation
Does Earnie make us CRA compliant?
No tool can do that on its own. Earnie produces evidence toward your CRA obligations: a current, defensible record of the components, models and cryptography in your software.
Getting started
How much does Earnie cost?
You pay for the datasets you use. The Earnie surfaces (web UI, MCP, CLI and CI/CD) are included. Request a demo for pricing.
Where is the documentation?
In the Earnie documentation.
How do I get started?
Request a demo. We will show you Earnie on code like yours.